Concentration Risk Management in Private Credit

Concentration risk in private credit, once a line item in a stress-test appendix, now appears in actual redemption queues and actual covenant waivers, and that is the subject of this piece. A May 2026 regulatory report states that the private credit market, at its current size, has not been tested through a severe economic downturn, and that the test it has not yet passed could expose leverage and borrower credit quality problems that remain hidden under normal conditions. The market has grown too large for that to stay an abstract worry. The FSB puts the market's size in the trillions, large enough that a shock to one firm or one sector no longer stays contained to that firm or sector, it transmits.

Some of that transmission is visible already in the software and SaaS cohort, which made up a sizable share of BDC portfolios built across the 2020-2025 lending vintage. Private credit marks on the same loans barely moved. That gap between what public markets priced in and what private lenders kept on their books is a forward indicator sitting in plain view, waiting for the marks to catch up to the fundamentals. The FSB also flags that private credit lending concentrates in a narrow set of sectors, technology, healthcare, and services chief among them, which complicates surveillance and raises the odds that a shock in one of those sectors spreads from a sector problem into a market-wide one. None of this requires panic. It requires a different operating model, one built to see concentration forming before it reaches a gate.

What makes concentration dangerous: co-movement, not individual default

A single borrower defaulting is a known, priced, and reserved-for event. Concentration risk is a different animal entirely: it is the tendency of loans that share a characteristic, a sector, a sponsor, a structure, to respond to the same shock at the same time, which can overwhelm a portfolio's loss-absorption capacity even when no individual loan looks alarming on its own. The FSB states this directly: in adverse conditions, exposures that look manageable individually can show higher-than-expected correlations, which complicates the job of managing and mitigating risk. That problem gets worse when counterparty disclosures are thin and banks cannot aggregate their own exposures across business lines, because the correlation is invisible until it activates.

Sector concentration is compounded by managerial concentration, since the top eight private credit managers control a large majority of the total market. Structural choices add another layer. Covenant-lite structures, which made up a significant and growing share of larger deals in 2025, reduce how often maintenance tests get triggered, and fewer tests mean fewer chances to catch deterioration early, precisely when early detection matters most.

Then there is the PIK mechanism, which turns co-movement into a two-stage hit. Payment-in-kind income counts toward net investment income, so when PIK loans concentrated in a stressed sector default or get restructured, NII falls and dividend coverage breaks down at the same moment. Valuation opacity causes much of this and gets fuller treatment later: a federal law enforcement agency has warned publicly about divergent and "creative" marking practices in private portfolios, and Level 3 asset marking lets reported NAV stay smooth while the underlying credit quietly deteriorates. A shadow drawdown estimated at 12 to 15 percent on a 95th-percentile CVaR basis matters because it has not yet shown up in anyone's reported numbers.

The three axes of concentration that portfolios must track

Concentration is not one thing with one symptom. It runs along three distinct axes, sector, borrower and sponsor, and structure, and each one becomes visible on a different clock. Treating them as a single checklist item misses the point: a portfolio can look fine on one axis and be dangerously stacked on another.

Sector concentration is the fastest-moving of the three. The FSB names technology, healthcare, and services as the sectors where private credit lending concentrates most heavily, and within technology, AI is pulling in two directions at once. Lenders now have to ask, continuously, whether a given portfolio company sits on the winning side of that split or the losing one, and that question does not get answered once at origination, it needs standing surveillance. Commercial real estate has its own version of sector timing, built around the calendar rather than technological disruption: office-backed debt and a fast-growing wave of multifamily maturities create pressure points that are foreseeable well in advance, which makes sector monitoring in CRE partly an exercise in tracking a maturity wall.

Borrower and sponsor concentration moves more slowly but hides more completely. The FSB warns that banks often cannot aggregate exposure across business lines or counterparty types, so a bank lending to a fund, backing a revolver for that fund's portfolio company, arranging a hedge, and holding deposits for the same sponsor may never see the sum of what it has at stake. The top five banks hold a large majority of committed loan amounts to BDCs, so sponsor concentration at the fund level nests directly inside borrower concentration at the asset level. Without a shared exposure graph connecting those desks, that signal never gets there.

Structural concentration becomes visible last, after sector and borrower concentration have already registered. Covenant-lite deals, second-lien tranches, and PIK-heavy structures all share a sensitivity to a credit cycle turning, no matter what sector the loans sit in. Semi-liquid vehicles add their own structural fragility: a maturity mismatch across a record $530 billion in global semi-liquid AUM means redemption pressure and credit deterioration can hit at the same time, as the first quarter of 2026 demonstrated. Over-collateralization and interest-coverage test failures tend to appear at the vehicle level well before they register in portfolio-wide credit metrics, as when the BlackRock private-credit CLO breached its OC test and forced a management fee waiver.

Why today's data infrastructure can't support concentration monitoring

The gap most firms face is that the data needed to see concentration forming sits scattered across documents, spreadsheets, and systems that were never built to talk to each other, and no amount of modeling skill compensates for data that cannot be pulled together fast enough to act on. The FSB names this directly as a governance problem at the system level: inconsistent definitions across jurisdictions and limited fund- and loan-level data make it difficult for regulators to even assess exposures and how a shock might travel through the system. Regulation alone will not close that gap. It has to be closed inside each firm's own data architecture.

Oxane's mid-year 2026 assessment names liquidity management, data quality, collateral verification, valuation governance, and portfolio oversight as the vulnerabilities that recent market stress has pushed into focus, and points to connected infrastructure, pulling borrower data, valuations, covenant monitoring, and reporting into one consistent view, as the fix. That matters because of where the inefficiency actually lives: information gathered during underwriting routinely stops moving once the loan closes. Loan agreement data stays locked in a document instead of feeding ongoing covenant monitoring, so operational teams end up re-reviewing the same facts at multiple stages of a loan's life instead of that work compounding over time. For CRE lenders in particular, financial spreading and covenant testing often still run off a spreadsheet updated once a quarter, so a covenant breach or a deteriorating DSCR becomes visible only after it is already a material problem, when there is no longer room to manage it. None of this is a skills gap. The data mostly already exists somewhere inside the firm, it is just not connected to anything that can act on it in time.

A systematic concentration monitoring framework in practice

A monitoring framework that actually works combines three things: exposure mapping across all three axes, covenant surveillance that runs continuously rather than quarterly, and early-warning signals built into a portfolio-level dashboard. Each piece addresses a specific failure mode described above, and together they close the lag between a risk forming and someone noticing it.

Exposure mapping starts by linking legal entity, ultimate sponsor, fund, underlying borrower, collateral, and bank product into a single structure, including undrawn commitments, not just current utilization, since a sponsor is most likely to draw down a facility exactly when portfolio liquidity is already strained. Treat that backlog as a governance gap, because that is what it is.

Covenant monitoring is where manual and automated workflows diverge most starkly. AI-enabled covenant monitoring reads loan agreements on an ongoing basis, pulls live property financials, and tests DSCR, LTV, and debt yield against their thresholds continuously, flagging a breach weeks before it would otherwise turn into a technical default that the lender only discovers after the fact. You can ask of any platform whether it just records a covenant or actually calculates compliance from the underlying financial statements. Covenant-lite structures raise the stakes here rather than lowering them: fewer maintenance tests mean the signals that remain carry more weight, and catching them early matters more, not less. A recent OCC bulletin on model risk management lays out principles around documentation, ongoing monitoring, and outcomes analysis, but it explicitly carves out simple arithmetic and deterministic rule-based calculations, the category most covenant tests fall into, and it does not specifically require that covenant calculations be traceable to their inputs and reviewable on demand. That is a gap in the rule, not in the risk, so firms building their own monitoring systems should build the audit trail in anyway, because an alert without a traceable calculation behind it is not something anyone can defend later.

Early-warning signals then round out the framework. Valuation governance now turns on how the assumptions behind those marks get built, challenged, and applied consistently, which makes scenario analysis and borrower-level sensitivity testing something to run routinely. As PIK income's share of total interest income climbs toward a critical threshold, a growing share of reported earnings is non-cash, and the gap between reported NAV and what the portfolio could actually realize widens quietly underneath it. For CRE portfolios specifically, maturity wall monitoring deserves its own layer: forecasting which assets face refinancing pressure in a given quarter, and which sectors face the heaviest concurrent maturities, works far better automated than assembled by hand at the point a refinancing is already due.

How AI and connected infrastructure close the monitoring gap

Manual workflows cannot deliver continuous monitoring at scale, no matter how skilled the team running them is. The delay is built into the process itself: a human reviewing a spreadsheet once a quarter cannot produce a weekly signal, regardless of how carefully they read it. The same chain structure applies directly to covenant monitoring: a signal comes from a financial statement, gets tested against a covenant threshold, generates an exception alert if it fails, follows a defined escalation path, and produces an audit record at every step. Connected infrastructure keeps underwriting data flowing into ongoing monitoring instead of filing it away once the loan closes, and that is what separates a lender reacting to a problem from one that saw it coming. When the data captured at origination keeps doing work throughout the life of the loan, the gap between a risk forming and someone seeing it shrinks from quarters to weeks.

What the regulatory trajectory requires from concentration management

Regulators are tightening standards in direct response to the exact vulnerabilities that surfaced across 2026, and that shift is turning systematic concentration monitoring from a best practice into a compliance requirement. In the EU, AIFMD II is pushing private credit managers toward operating more like regulated lenders, with leverage limits, risk retention rules, liquidity management tools including redemption controls, concentration limits, and tighter governance. Each of those requirements maps to a specific monitoring capability that has to actually run, not just exist on paper. In the US, OCC Bulletin 2026-13 on model risk management requires covenant calculations to be traceable to their inputs and reviewable on demand, which means an automated monitoring system has to produce a defensible audit trail alongside its alerts. Governance, in other words, is becoming a technical requirement of the monitoring stack itself, not a compliance layer bolted on afterward.

The FSB has been explicit that data gaps are hindering effective oversight at the system level, and it is pushing for better fund- and loan-level reporting from market participants. Firms that have already built connected data infrastructure will be positioned to meet those enhanced reporting requirements as they arrive, rather than scrambling to build the plumbing under deadline pressure once the rule is final. A firm that treats concentration monitoring purely as a box to check ends up with point-in-time compliance and nothing more. A firm that builds it as a standing operational capability gets both the compliance posture and the early-warning advantage, and those two outcomes are not actually in tension, they fall out of the same well-designed infrastructure. Concentration risk compounds precisely when it stays invisible. The institutions that build the capacity to see it early are the ones that manage it on their own terms, before it surfaces in a redemption queue.